We have ephemeral run --bind-storage-ro, it'd make sense to support for libvirt too - we could build on that to make it easy to do bootc upgrade from that storage!